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The International Space Station (ISS) represents the culmination of over two decades of 
unprecedented global human endeavors to conceive, design, build and operate a research laboratory 
in space. Uninterrupted human presence in space since the inception of the ISS has been made 
possible by an international fleet of space vehicles facilitating crew rotation, delivery of science 
experiments and replenishment of propellants and supplies. On-orbit propulsion systems on both ISS 
and Visiting Vehicles are essential to the continuous operation of the ISS. This paper compares the 
ISS visiting vehicle propulsion systems by providing an overview of key design drivers, operational 
considerations and performance characteristics. Despite their differences in design, functionality, 
and purpose, all visiting vehicles must adhere to a common set of interface requirements along with 
safety and operational requirements. This paper addresses a wide variety of methods for satisfying 
these requirements and mitigating credible hazards anticipated during the on-orbit life of propulsion 
systems, as well as the seamless integration necessary for the continued operation of the ISS. 
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Nomenclature 

change in temperature in °C 
change in velocity in m/s 
thrust in kg f (1 kg f = 9.807 N) 
specific impulse in seconds 

constant derived from the acceptance test data for each type of thruster 

constant derived from the acceptance test data for each type of thruster 

mass of propellant consumed in kg 

average pressure of all tanks feeding a thruster in kg/cm 2 

total on-time in seconds 


I. Introduction 

T housands of investigators from around the globe have utilized the ISS since its inception as an orbiting 
laboratory to perform unique research in such diverse fields as biology and biotechnology, Earth and space 
science, human physiology and performance, education, physical sciences and technology. Earth observation 
capabilities on the ISS serve as a rapid-response platform to monitor climate change, disasters and urban growth on 
Earth. The research in microgravity environments has inspired future scientists, engineers and space explorers while 
advancing our understanding of key issues affecting space exploration and mastering the materials technology to 
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enable easier access to space. The ISS partnership is a model of what will be needed if an ambitious program of 
exploration beyond low-Earth orbit (LEO) is to move forward. Extending the service life of ISS systems beyond 
2020 and possibly to 2028 would ensure continued utilization of this unique platform to facilitate cutting edge 
research to the benefit of humanity. 

Uninterrupted research on the ISS requires a robust fleet of space vehicles enabling crew rotation, delivery of 
science experiments, replenishment of propellants and supplies and augmentation of propulsive capabilities. Since 
the launch in 1998 of its first module the Zarya, or FGB, crew and cargo visiting vehicles have provided the ISS its 
lifeblood of cargo and consumables, including propellants. Multiple international partners and commercial 
contractors have designed, built, and operated these visiting vehicles. In spite of their unique design features tailored 
to address differences in functionality, operational and performance characteristics, the vehicles must meet a range 
of interface requirements, along with safety and operational requirements, stipulated in a dedicated set of documents 
such as the common Safety Requirements Document (SRD), individual Interface Requirements Document (IRD), 
Segment Specification, ISS Flight Rules, etc., such that the mission objectives are met without compromising ISS 
safety. Seamless integration of these vehicle systems on the ISS requires careful mission planning, safety 
coordination and system analyses. 

A common denominator that integrates vehicles with the ISS is NASA’s Systems Engineering and Integration 
(SE&I) process, implemented by the Vehicle Integrated Performance Environments and Resources (VIPER) Team. 
As part of VIPER, the ISS Propulsion Team ensures that the visiting vehicle propulsion systems adhere to systems 
engineering best practices to meet ISS operational and safety requirements. 1 

The propulsion systems of the ISS permanent elements, or modules, are of Russian heritage designs, and 
significant portions of Russian systems had been tested and flown on Mir space station prior to the construction of 
the ISS modules. The Zvezda, or Service Module (SM), for example, is an enhanced version of the Mir base block 
module and was originally built to support the Mir 2 program. As a result, much of the flight data from Mir’s 
propulsion system is applicable in ISS operations and integration. The heritage and lessons learned during the past 
decades of both Russian and American spaceflight have been applied to the integration of visiting vehicles to the 
ISS. 

The crew and cargo vehicles that have visited the ISS include the Progress and Soyuz vehicles 2 , the Space 
Shuttle Orbiter, European Space Agency’s (ESA’s) Automated Transfer Vehicle (ATV) 3 , Japan Aerospace 
Exploration Agency’s (JAXA’s) H-II Transfer Vehicle (HTV) 4 , and Space Exploration Technologies Corporation’s 
(SpaceX’s) Dragon. Orbital Sciences Corporation’s (Orbital’s) Cygnus is scheduled to fly for the first time to the 
ISS during 2013 and, like SpaceX, will fly a number of flights under the Commercial Orbital Transportation 
Services (COTS) prior to commencing resupply missions under the Crew Resupply Services (CRS) contract. Exact 
specifications of these vehicles are beyond the scope of this paper; however an attempt is made to present the 
differences in basic design features, performance, and operations. Also not included in this paper are details related 
to the future visiting vehicles that are under development for the Commercial Crew Integrated Capacity (CCiCAP) 
and Commercial Certification Program (CCP) contract by Boeing, SpaceX and Sierra Nevada. 


II. Propulsion System Considerations 

Design and operations are driven by requirements and constraints levied by the ISS Program, by international 
agreements, mission goals, and the intended purpose of the visiting vehicle. These all cover a variety of different 
purposes and scenarios. The fragility of human life and health imposes stringent requirements on the vehicle to 
maintain crew safety. In addition, as the most valuable space asset, a need for continued operation and performance 
of the ISS without being adversely affected by the visiting vehicles makes the design and operational requirements 
even more demanding. 

The intended purpose of the vehicle and the mission goals require the visiting vehicle to be capable of 
successfully arriving at and departing from the vicinity of the ISS, successfully rendezvousing with the ISS, and 
completing a docking or berthing. A cargo vehicle is used for logistics resupply and delivers dry cargo as well as 
water, propellant, and atmospheric gases to the ISS. Propellant resupply also includes propellant transfer to the SM 
and through the SM to the FGB for propellant storage. The cargo aboard must be delivered either by the crew, 
which requires additional safety factors so that the crew can enter the vehicle without risk of injury or death, or 
autonomously, as in the case of propellant refueling or external payloads. The propulsion systems in the visiting 
vehicles mandate additional considerations such as erosion and structural loads induced by thruster plume 
impingement on ISS hardware, ISS contamination caused by propellant leakage, mechanical and thermal stresses, 
and the risk of thruster failures during firing. 
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In order to protect both the crew and the ISS hardware, NASA has defined a set of priorities to which all visiting 
vehicles must adhere. Crew safety is always the requirement of highest priority, followed by the safety of the ISS 
hardware. The ISS lifetime must be protected, for all of the components of the ISS have a limited lifespan, either in 
operational on-time and number of cycles, or in how much wear they can sustain before performance is degraded. 
For example, thruster plumes can erode the solar arrays which subtracts from their lifetime and therefore from the 
lifetime of the ISS. The Service Module (SM) thrusters have certified lifetime limits based on the cumulative on- 
time and the number of times that they are fired (i.e., number of cycles). Protection of the docking and berthing 
capability of the ISS is important, as the ISS would be incapable of long-term operation without the continuous 
stream of visiting vehicles. The safety of the visiting vehicle is also critical, followed by overall mission success, 
e.g. the continuation of the planned mission objectives, including propellant transfer, cargo delivery, vehicle testing, 
etc. 

The SRD and IRD formally lay out the requirements levied on all visiting vehicles by the ISS Program. The 
SRD defines a set of hazards, all of which are common to propulsion systems regardless of design, and for each 
individual vehicle, the IRD maps these hazards to the design of the specific vehicle. The IRD, for instance, mandates 
a certain number of inhibits, mechanical, electrical or both, against these potential hazards, depending on their 
severity. In addition, the IRD requires strict quality control in the manufacturing, assembly, and loading of 
propulsion systems in order to mitigate many of these common dangers . 5 

Hazard control can be defined as the use of design and operational measures to reduce the likelihood of 
hazardous effects. Provisions of appropriate design features to eliminate the hazard, materials, parts selections, and 
safety factors and design considerations to include damage control, containment, isolation of potential hazards, and 
failure tolerance considerations are all part of hazard control. Incorporating safety devices reduces the hazards to 
acceptable levels, and the use of warning devices, crew operational procedures, and protective clothing and/or 
equipment minimizes the effects of potential hazards 6 . 

The three most common propulsion system hazards are: collision, contamination, and explosion. A significant 
number of causes can result in each of these hazards, and their mitigation is a main driver of propulsion system 
design. 

NASA has placed these hazards into two categories: catastrophic and critical. The SRD defines a catastrophic 
hazard as a condition resulting in severe personnel injury, loss of life or loss of a human space vehicle. A critical 
hazard is one resulting in a non-disabling personnel injury, severe occupational illness, loss of a major element or 
functionality in human space vehicle or a ground facility. The mitigation requirements depend on the category into 
which a hazard falls. A catastrophic hazard must be protected against by three independent inhibits, or be two fault 
tolerant, so that that no combination of two failures, two operator errors, or one of each can result in a catastrophic 
hazard. No single failure or single operator error can result in a critical hazard. 

Fault tolerance is one of the preferred hazard control methods comprising functionally redundant systems to 
prevent failures from causing catastrophic consequences. For example, propellant tanks must be two fault-tolerant 
against over-pressurization, as a propellant tank rupture can result in catastrophe. Pyrotechnic valves that could 
cause a catastrophic event in the case of premature firing must also be two-fault tolerant. ISS safety requires a 
minimum of three mechanical inhibits and three independent electrical inhibits to prevent an inadvertent thruster 
firing. At least two of the three required inhibits need to be monitored. 

Other methods of addressing hazard control requirements are design for minimum risk (DFMR), isolation, and 
operational control. DFMR allows for unexpected events or anomalies by eliminating all credible failure modes 
within a specific operating range, demonstrated by test and analysis showing significant margin over the operating 
limit. Procedures should be written clearly and precisely to avoid operator error and protect against hazards such as 
an incorrect valve configuration that might inadvertently allow pressurant to enter the propellant tanks. When not in 
use, portions of the propulsion system can be isolated to protect other parts of the vehicle. Implementation of the 
Fault Detection, Isolation and Recovery (FDIR) system is essential to monitor the health and operation of the 
propulsion system. If the FDIR detects that the system is out of configuration or nearing a hazard, it can either abort 
the operation, isolate the problem or execute commands to prevent the hazard. For example, the FDIR constantly 
monitors the Guidance, Navigation and Control (GN&C) system of a docking vehicle and if it detects incorrect 
variances in expected vehicle attitude and position, it will automatically command the vehicle to proceed on 
functionally redundant systems. If the errors continue to decrease the fault tolerance level, the FDIR will eventually 
abort the docking or berthing operations and place the vehicle in a safe trajectory away from the ISS. 
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III. Design Drivers for Pressure Systems 

One of the largest design drivers is the consideration of pressure. The pressurant and propellant are stored under 
high pressure, and the thrusters are open to space and experience vacuum conditions. The extreme environment 
mandates a system robust enough to operate under all possible conditions and scenarios. 

Water hammer, or sudden surge transient pressure, presents a significant challenge for spacecraft propulsion 
systems. Variation in spacecraft thermal environment can create large pressure differences across the isolation 
valves in fluid lines. Opening a fast response valve with sufficiently high pressure difference across can lead to 
water hammer. Thus when a propulsion system is primed after launch or on orbit, water hammer could potentially 
cause damage to the valves, components or line segments. 

Some vehicles solve the problem of water hammer during system activation by using slow-acting motor valves, 
which decrease pressure surges. Other systems use a flow-restricting orifice, venturi, or flow limiter plate to reduce 
the maximum surge pressure to a manageable level. HTV uses a novel method for managing the pressure surge by 
heating up the propellant lines to recover the downstream pressure before opening the isolation valves 7 . In some 
cases, manifolding line segment dead ends together and extending the line segments mitigates the maximum surge 
pressure 8 . All of these, however, require additional hardware, and in some cases require re -priming of the propulsion 
system every time that it is activated for use. 

Propulsion system components are rated for a Maximum Design Pressure (MDP), which is defined as the 
highest pressure driven by the maximum relief pressure, maximum regulator pressure, maximum temperature and 
transient pressure excursions 9 . MDP for manned spacecraft pressurized systems is collectively the pressure resulting 
after two failures. For example, MDP accommodates any worst combination of two credible failures of the relief 
valve and/or regulator. Some components are designed with a Maximum Expected Operation Pressure (MEOP), or 
the maximum pressure at which the system or component nominally operates in an actual application, which 
includes the effects of temperature, transient peaks, vehicle acceleration, and relief valve tolerance 10 . The MDP shall 
have sufficient margin above the MEOP to account for contingency situations. During qualification, each 
propulsion system component is required to be tested to and meet higher factors of safety called proof pressure and 
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Figure 1. Visiting Vehicle Design Parameters 
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burst pressure. For low pressure components, proof pressure and burst pressure are usually defined as 1.5 times 
MDP and 2.0 times MDP, respectively. For high pressure components and lines/fittings, proof pressure and burst 
pressure are typically defined as 1.5 times MDP and 4.0 times MDP. 

Visiting vehicle propulsion systems must protect against over-pressurization, which might result, for instance, 
from a change in temperature or a pressure regulator failure. The most common protections are burst disks and relief 
valves. The majority of 1SS visiting vehicles have relief valves on the propellant tanks, and several have both relief 
valves and burst disks. Flowever, a few of the vehicles have neither, and these rely on the robustness of their 
propulsion system design and a wide margin for pressure increase before possibility of rupture becomes a real threat. 

Primary regulator set point is an important design parameter. All other pressure levels - lock up pressures, set 
point of the secondary regulator, maximum pressure at which a propellant tank arrives at the ISS, with or without a 
blowdown phase - depend on this single parameter. Assuming no change in the fill fraction of propellant tanks 
(defined as the ratio of propellant volume to tank volume), subsequent increase in pressure depends on the initial 
conditions (pressure, temperature and fill fraction), change in temperature and the sensitivity of propellant vapor 
pressure and density to the temperature change. Generally, due to its higher vapor pressure, nitrogen tetroxide 
(NTO) tank has a higher over pressurization potential and is monitored closely by the ISS safety and operational 
teams. 

Figure 1 compares some of the propulsion system design parameters selected by the visiting vehicles and 
permanent modules on the ISS. Some vehicles have two independent propulsion systems, one for its free flight and 
ISS integrated operations and another for resupplying ISS propulsion system. These are shown as different vehicles 
and modules in Figure 1. 


For ease of comparison, a safety margin is defined as the difference between Critical Pressure and the set 
pressure of the primary regulator, where Critical Pressure is defined as the rupture pressure of the burst disk or 
cracking pressure of the relief valve, whichever is used to prevent over-pressurization. For the systems that do not 
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use rupture disk or relief valves for mitigating the over-pressurization risk. Critical Pressure is considered to be 
equal to the MDP of the propellant tank. 

Figure 2 illustrates the significance of the Safety Margin by comparing the over pressurization potential in 
Vehicles 1 and 3, with an initial temperature of 15° C in both. ISS temperatures see the hottest or coldest 
temperatures during beta 1 1 angle extremes (depending on where the hardware is relative to the sun). The maximum 
temperature swing (AT max) usually occurs when entering or leaving this beta period. Since NTO tank pressure 
variation is more susceptible to temperature excursions, the temperature increase (AT) that an NTO tank can sustain 
without causing over-pressurization is an important consideration and has to be more than its AT max for a given 
mission. 

As seen in Figure 1, the margin is -40 psid in Vehicle 1 and -100 psid in Vehicle 3. For a 30% fill fraction, it 
can be seen in Figure 2 that Vehicle 1 reaches its Critical Pressure at a AT = 15° C, whereas Vehicle 3 would not be 
at over-pressurization risk until the AT max reaches -35° C. While on the ISS, the propellant tank on Vehicle 3 
would therefore be able to tolerate larger temperature changes than Vehicle 1 without the risk of reaching its critical 
pressure. A lower margin on the Space Shuttle propulsion systems was less of a concern due to its short mission 
duration, better thermal control and ability to vary its fill fraction during ISS integrated operations. Interestingly, the 
Apollo Command Module, Service Module and Lunar Module propulsion systems also benefited from similar 
features so as to be able to afford a lower margin. 

Based on a survey of best practices used across various vehicles over the life of the space station, a 100 psid (— 
0.7 MPa) margin is considered appropriate for safe operation, especially in the absence of mitigations discussed 
above. 


IV. Integration and Operations 

In the same way that the IRD and SRD provide guidelines for design, flight rules dictate requirements for 
operation and integration and clearly identify responsibility and authority for mission operations 11 . Flight rules 
govern all aspects of the ISS Program’s operations, and each visiting vehicle has its own dedicated volume. They are 
developed in a joint effort by Mission Operations Directorate (MOD), ISS subsystem specialists, and specialists 
from the organization that owns the vehicle. The following section discusses the flight rules and many of the aspects 
of operation they cover, as it applies to propulsion systems. 

The purpose of flight rules is to integrate relevant engineering constraints, outline procedures for nominal 
mission operations, assign responsibility and authority, and plan a course of action for potential contingencies and 
anomalies prior to the actual mission. The harsh environment of space implies that the safety of the crew depends on 
the system’s ability to react quickly to the loss of almost any system or portion of a system. 

A. Propellant Quantities and Management 

For a propulsion system, the first set of applicable flight rules are those governing propellant quantities. Micro 
gravity presents a number of challenges in gauging propellant quantities. The amount of propellant remaining in a 
tank is typically not directly measured due to weightlessness and the effects of acceleration upon the tank contents. 
Therefore calculation must be relied upon instead. Four primary methods of calculated propellant quantities have 
been used over the course of the ISS program, some with more success than others. 

The first method is the Pressure- Volume-Temperature (PVT) method, which utilizes the ideal gas law 12 . The 
second method is a Burn-Time Integration (BTI). This utilizes the thrust and specific impulse of a thruster manifold 
to calculate the amount of propellant consumed by a particular thruster. The total consumption of each thruster is 
calculated using the formula: 


m — F * T on /I sp 

where m = mass of propellant consumed in kg, F = thrust in kg f , T on = total on-time in seconds, and I sp = 
specific impulse in seconds. Thrust for a manifold of thrusters is determined by the formula: 

F = {K1* P avg ) + K2 


Beta angle is the angle measured between the Sun vector and the ISS orbital plane, which is inclined 51.6° to the Earth’s 
equator. 
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where F = thrust in kg f and P avg = the average pressure of all tanks feeding the thruster in kg/cm 2 , with a 
maximum possible value equal to the nominal thrust of that thruster. The constants K 1 and K2 are derived from the 
acceptance test data for each type of thruster. 

These two methods, PVT and BT1, are the primary methods of propellant quantity gauging for the 1SS Program. 
However, additional methods have been used as well, namely a physical measuring device utilizing the properties of 
bellows tanks and a method utilizing radio frequencies. 

For each vehicle, the flight rules define three propellant quantities as the amounts required for certain critical 
operations. This helps the mission operations team to know what the propellant consumption priorities are, which in 
turn allows them to make decisions if the propellant level falls below the requirement at certain points during the 
mission. In general, the most critical priority level is the propellant required for a worst-case undocking, release, or 
abort, and a controlled re-entry. The second priority level usually includes the propellant required for nominal 
approach and docking/capture. The third priority level usually includes other nominal mission objectives and the 
possibility of a re-rendezvous attempt in the case of an abort. The flight rules define these and potentially other 
priority levels and what falls into each category for each vehicle. However, the actual amounts required for each 
priority are assigned on a mission-specific basis. 

For the most part, visiting vehicles operate in regulated pressure mode from system priming all the way through 
docking or capture. Some missions have been accomplished in blowdown mode near the 1SS. Operating in 
blowdown mode reduces the risk of ISS hazards caused by the high pressure system. However, a propellant tank re- 
pressurization could potentially be required, depending on how far the pressure falls during blowdown mode 
operations. Based on the approved design and operational controls against the potential hazards, flight rules allow 
predetermined operational modes during ISS proximity operations. 


B. Proximity Operations 

Once a vehicle reaches the vicinity of the ISS and begins Proximity Operations, the bulk of the flight rules come 
into effect. Before that point in free flight, the ISS Program has little input into the operations of a vehicle, although 
ISS Program Specialists, including the Propulsion Team, continuously monitor the health and status of the vehicle. 

A visiting vehicle uses one of the two methods available for mating to the ISS structure: autonomous docking, or 
capture and berthing. The former allows the vehicle to dock to the ISS using its own propulsion system. This is the 
method used by the Progress, Soyuz, Shuttle, and ATV. 
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Figure 3. ISS Visiting Vehicle Docking and Berthing Ports. 

The second mating method, berthing, requires the vehicle to approach the ISS and enter a capture box where the 
Space Station Remote Manipulator System (SSRMS) arm reaches out and captures the vehicle. The visiting vehicle 
transitions to freedrift by inhibiting its thrusters prior to being captured by the SSRMS. The SSRMS then maneuvers 
the vehicle into place and berths it to one of the Node 2 berthing ports, usually Node 2 Nadir. Dragon, Cygnus, and 
HTV all use this method. 
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Both mating methods require a precise use of the visiting vehicle’s propulsion system. Rendezvous is one of the 
most critical portions of the entire mission, as collision with the 1SS is a concern. At this stage the fault tolerance 
requirements and FD1R are critical. Motion control capability is of vital importance, as a vehicle ‘dead in the water’ 
in the vicinity of the ISS presents a large number of serious risks. The exact number of thruster failures and thruster 
set failures allowed during Proximity Operations depends on the vehicle design, but a positive fault tolerance is 
required at every point. 

Figure 3 shows a diagram of the configuration of the ISS visiting vehicle ports, including the position of the 
Multipurpose Laboratory Module (MLM), scheduled for the end of 2013. Four main Russian docking ports currently 
exist: the SM-Aft port, the Mini Research Module (MRM) 1 Nadir port, the MRM2 Zenith port, and the Docking 
Compartment-1 (DC-1) Nadir port. DC-1 currently is docked to the SM Nadir and will be undocked and deorbited 
and replaced by the MLM, which has its own docking port. All current docking vehicles use these ports. In addition, 
the Pressurized Mating Adaptor 2 (PMA2) docking port is attached to Node 2 on the US side, which allows US crew 
vehicles to dock. This port was utilized by the Space Shuttle Orbiters but is now unused due to the lack of a US crew 
vehicle. In addition, the US Segment has two berthing ports: Node 2 Nadir and Node 2 Zenith. 

Ideally, closing the propulsion system isolation valves and inhibiting the thrusters provides necessary barriers 
against leaking thrusters, inadvertent thruster firings and overpressurization concerns during ISS integrated 
operations. However, if this is not possible due to vehicle specific constraints, adequate controls shall be in place to 
mitigate hazards to ISS assets. For instance, if required number of mechanical inhibits cannot be put in place to 
prevent potential leakage or inadvertent firing, electrical inhibits combined with a successful leak check prior to 
transitioning the propulsion system to dormant mode may be acceptable. Each specific case needs to get formal ISS 
Program approval. 

Once an autonomous vehicle docks to an ISS port, the thrusters are immediately inhibited so no thrusters can fire 
when the locking mechanisms are activated. Once the vehicle is secured, the propulsion system remains isolated 
unless they are to be used to support ISS attitude control. Currently, the Progress and the ATV are the only vehicles 
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capable of providing propulsive support to the ISS. However, the Soyuz can be used in very rare contingency cases, 
as its propulsion system is to be preserved for crew return. The US Orbiter also provided propulsive support during 
mated missions. If the vehicle can be used for propulsive support, the flight rules governing operating temperatures 
and pressures are followed to ensure nominal performance. 

Visiting vehicles must prepare for departure if any failure while docked or berthed would cause the risk of 
damage to the ISS or the crew. For example, if the propulsion system develops a leak that cannot be isolated, the 
visiting vehicle must prepare to depart immediately to prevent contamination and explosion hazards, while still 
maintaining the ability to depart safely with available propellants. 


C. ISS Propulsive Support 

ISS propulsive control is managed by the Service Module computers. The primary mode of operation is under 
Russian Control using the Russian software, called Russian Segment Motion Control System (RS MCS). However, 
a US-only thruster (USTO) mode of operation is also possible. This mode puts the RS thrusters under US command. 
Under both modes, a wide range of thruster configurations are available for both translation and attitude control. The 
Service Module provides control in all three axes (although its roll control is not particularly efficient), and a 
Progress or an ATV at the SM-Aft docking port can provide control in all three axes as well. A Progress at DC-1 



12000 


10000 


6000 


4000 


2000 


Figure 5. ISS Mean Altitude vs. Yearly Propellant Consumption. 

Nadir can provide roll control. When MLM is integrated with the ISS, Progress docked to the MRM2 Zenith port 
and MLM are likely to be the primary sources for roll control, essentially eliminating the need for SM roll thrusters 
which are approaching the end of their operational lifetime. For translation, four options are currently available, 
depending on the vehicle configuration. ISS reboost can be achieved by firing aft thrusters on a Progress or ATV 
docked at SM-Aft. A Progress docked to DC-1 Nadir can also perform a less efficient but still successful reboost 
using its mid-ring thrusters, although it cannot provide a AV greater than 0.7 m/s due to thruster on-time restrictions. 
If the SM-Aft port is vacant, the SM Main Engines can perform orbit reboosts. 
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A significant portion of ISS thruster control is dedicated to translational control, mostly in the form of reboosts. 
Figure 4 shows the accumulated AV against the ISS mean altitude over the life of the ISS Program. Over 400 m/s of 
AV has been imparted to ISS since the launch of the FGB in 1998, which translates to a significant portion of the 
ISS propellant consumption. Figure 5 shows the mean altitude compared against yearly propellant consumption. In 
the years that the altitude was allowed to decay naturally (e.g. 2003 - 2006), the yearly propellant consumption was 
significantly lower than in years in which frequent translational maneuvers were used to change the ISS mean 
altitude in a significant manner. It may be noted that after Space Shuttle Columbia disaster in 2003, logistics and 
crew flights to the Station were limited to the Russian Progress and Soyuz vehicles for about two years. Following a 
successful return-to-flight mission in 2005, which fulfilled the safety evaluation and test objectives, regular Space 
Shuttle flights to the ISS resumed in 2006. Propellant usage increased dramatically in 2008 to support a relatively 
busy assembly period in ISS construction, featuring four Shuttle flights, six Russian crew/cargo vehicles, one ATV 
and three EVAs. ISS orbit was raised by about 20 km and the overall mass increased by over 20%, with the arrival 
of several new modules in 2008. 

Three ATV vehicles - Jules Verne (2008), Johannes Kepler (2011) and Edoardo Amaldi (2012) - together 
performed a total of 25 maneuvers to provide 67 m/s of ISS reboost at an expense of 8400 kg of propellants. 
Attitude control propellants during these reboost maneuvers accounted for an additional 1926 kg. A 40% growth in 
ISS mass during the assembly period 2008-201 1 had caused a corresponding increase in the reboost propellant cost. 

An important function of visiting vehicles from a propulsion system standpoint is the supply of delta-V both 
through refueling capability and through direct propulsive support. Figure 6 shows the on-board propellant capacity 
of the ISS along with yearly consumption. Onboard propellant capacity increased by about 850 kg after the SM 
docked and became part of the ISS in July, 2000. The propellant consumption shown by vertical bars includes 
propellants supplied by various visiting vehicles. Figure 7 shows the accumulated amount of propellant consumed 



Figure 6. ISS On-Board Propellant Load vs. Yearly Propellant Consumption 
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over the life of the Program. With the exception of the propellant carried up by the FGB and SM at their launch, all 
of the nearly 80,000 kg of propellant came up with visiting vehicles. This amount includes the propellant consumed 
by the visiting vehicle to provide propulsive support and the propellant manifested up to the ISS modules. 

D. Refueling 

Transferring propellant presents a unique set of challenges. Whether the propellant is being transferred into the 
ISS tanks for resupply or the propellant is being fed to the Progress thrusters during a propulsive event, the 
propellant must pass through the interconnect lines on the docking hatch. Before this can be done, a leak check is 
performed by pressure decay method. In this process, gaseous pressurant is fed into the interconnecting lines and 
held under pressure (~210 psia) for 1 orbit while being monitored for leakage. If no pressure decay is observed, the 
vent valves on the docking port are then opened to allow the pressurant to escape into vacuum. After a successful 



leak check, propellant transfer can be performed. 

When the vehicle is ready to undock, it is necessary to purge the propellant in these same line segments. First, 
the line segments of the docking interface are isolated and the vent valves are opened to vent the majority of the 
propellant. Then, similar to a leak check, the pressurant valves are opened and the pressure from the pressurant tanks 
forces the remaining propellant out into space. To mitigate the risk of combustion outside the vehicle, the fuel is 
purged alone first, and then after an orbit, the oxidizer is purged separately through a different vent valve on the 
opposite side of the port. Lastly, the lines are allowed to vacuum dry for a few minutes. Of course, if no propellant 
was transferred between the two vehicles at any time, such as on a Soyuz mission, then a propellant purge is not 
necessary. 

E. ISS Contamination 

While unsymmetrical dimethyl hydrazine (UDMFl), monomethyl hydrazine (MMH), and nitrogen tetroxide 
(NTO) are all hazardous to human health, the general risks of crew or ISS atmosphere contamination from visiting 
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vehicle thrusters are relatively minor. However, during an Extra Vehicular Activity (EVA), the crew can potentially 
be exposed to toxic propellants. Fuel and oxidizer reaction product (FORP), for instance, can accumulate, 
particularly near the thrusters, and not dissipate through sublimation or evaporation. Exposure to FORP is 
sometimes unavoidable if the EVA tasks require the crew to work near thrusters or propellant vents. Assuming the 
crew’s suit does get contaminated, flight rules and procedures dictate that the crew frequently inspect and wipe 
down the suits and gloves in addition to stringent procedures for cleaning the suit when the crew has completed their 
tasks. 

1SS contamination can also result from gross propellant leakage from propulsion system hardware in an EVA 
path. Contamination can be deposited on a spacesuit and then introduced into the ISS atmosphere by the EVA crew. 
While this concern is generally considered non-credible because most of the contamination evaporates rapidly, flight 
rules exist to protect against it and preventative procedures have been created due to the severity of the risks, should 
contamination of the internal environment occur. If the airlock does become contaminated, frozen propellant 
particles will evaporate readily under spacecraft cabin pressure conditions; and by subsequently exhausting and 
repressurizing, the contamination can be eliminated. This procedure clears the airlock of the contamination, adding a 
final level of safety to protect the crew before they re-enter the ISS. 

ISS flight rules dictate Keep Out Zones (KOZ) to make sure the EVA crewmembers stay a safe distance away 
from the thrusters that could potentially leak or fire inadvertently. Experience with Space Shuttle and test programs 
studying propellants sprayed into vacuum have shown that small liquid leaks flash and vaporize almost instantly. 
Frozen or supercooled liquid is formed only with large, sustained leak rates greater than 150-300 grams/hour. It is, 
therefore, imperative for the visiting vehicles to show that the maximum undetectable propellant leakage will be less 
than 150 grams/hour 13 . 

The flight rules also specify a minimum number of thruster inhibits required for crewmembers to be able to 
safely enter a defined KOZ. The KOZ for ATV thrusters, for instance, is specified as 1 m radius proximity and 60° 
half angle cone downrange. If crewmembers have to get within the KOZ, a minimum of two mechanical inhibits 
each in fuel and oxidizer lines should be present. Two closed valves in series in each propellant line offer one fault 
tolerance against gross leakage and more than 2 fault tolerances against inadvertent firing, thus providing adequate 
mitigation against both critical (leakage) and catastrophic (firing) hazards. In addition to the mechanical inhibits, 
inadvertent thruster firing risk is mitigated by having three independent electrical inhibits. 

If, for some reason, the required minimum mechanical inhibits cannot be in place and the EVA path requires the 
crewmember to enter a thruster KOZ, some workarounds maybe possible. For instance, leak checks will be 
mandated prior to EVA to demonstrate unambiguously that the thrusters will stay leak tight during EVA. Any 
undetectable leakage has to be less than 150 grams/hour, as described above. In addition to the leak check, visiting 
vehicles have to demonstrate, by way of Review of Design (ROD), that the thruster valves are fail safe (i.e., close 
when power is removed) and a positive upstream pressure helps them stay leak tight. The ROD must support the 
premise that there is no credible failure mode to cause leakage in a thruster that has been unused since its last good 
leak check, as long as it stays within its mechanical loads, thermal and aging limits. Once the leakage integrity is 
confirmed, the requirement on mechanical inhibits can be waived. However, the required number of electrical 
inhibits will still have to be in place. It may be noted that such workarounds are used only in exceptional cases, 
recognizing the fact that a lack of mechanical inhibits lowers the fault tolerances against potential hazards. Hence 
the requirement to demonstrate leakage integrity is quite stringent. 

Similar approach can also be applied when thruster inhibits are specified for events such as robotic 
capture/release of a visiting vehicle. Mobile Transporter (MT) translation, etc. Inadvertent thruster firing, rather than 
leakage, is a concern for these tasks sensitive to structural loads. If it is not possible to have the required number of 
mechanical inhibits in place, in addition to the measures described above, visiting vehicles have to demonstrate that 
the maximum instantaneous thrust and total impulse generated by inadvertent firing of a single thruster would not 
exceed the allowable limit of the weakest structural member. For reference, a maximum instantaneous thrust of 0.13 
N and total impulse resulting from leakage of trapped propellant volume of 600 cc (6 x 10' 4 m 3 ) have been found 
acceptable in the past. Anything larger than this will have to be analyzed on a case by case basis. 

F. Departure and Abort Capability 

Departure, like approach and rendezvous, presents a number of challenges for the visiting vehicle propulsion 
systems. Departure from the ISS must be accomplished without damage to either the ISS or the visiting vehicle. In 
general, the ISS thrusters are inhibited just prior to departure in order to mitigate the risk of thruster firings during 
the first few critical moments after release or separation. Where necessary, the visiting vehicle may perform some 
departure readiness steps such as valve cycling, repriming, etc. prior to release. 
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All visiting vehicles are required to have abort capability to protect against propulsion system failure or 
malfunction. This abort mode is programmed to take effect in a variety of scenarios, including but not limited to: an 
unsafe trajectory; loss of pressurization during regulated mode; thruster failure; or a delay in the departure burn 
regardless of the reason. This does put requirements upon the form and execution of a potential abort, which must be 
considered when designing the vehicle and the flight software. 

A number of causes have the potential to result in a failed thruster. These causes include but are not limited to a 
thruster valve failing open or closed, the injector temperature exceeding or falling below temperature limits, or the 
chamber pressure exceeding or falling below the pressure limits required for thruster operation. If pressurant is 
ingested into the propellant, off-nominal thrust can result in a thruster being declared failed by the software. Several 
temperature or pressure sensors failing on the same thruster can result in a thruster failure. In addition to individual 
thruster failures, an entire set of thrusters can be declared failed. Generally this is due to one of the following causes: 
a thruster valve in the set is considered to be leaking propellant, the driver or power chain is failed, a failed ON 
thruster, or more than a predetermined number of thrusters in the set are declared failed. The flight rules define the 
critical failures and the course of action to be followed including the FDIR response. 

The ISS Propulsion Team continues to monitor the health and status of the vehicle’s propulsion system even 
after it leaves the ISS vicinity. For unmanned vehicles, the ISS Program has few flight rules regarding operation 
after this point, as the vehicle has no further potential for immediate impacts to the ISS except for flight articles that 
are returning as payload, and the continued monitoring is only used to gather further performance data for 
evaluation. The ISS Program monitors manned vehicles closely all the way through touchdown, as crew safety is 
paramount in any operation. 


V. Conclusion 

The ISS has proven to be the crown jewel of the international collaboration by establishing itself as a 
sophisticated orbiting laboratory to perform research that is increasingly benefiting humankind. The ISS is making a 
positive impact on the quality of life here on Earth. Continued operation of this cutting edge scientific research 
laboratory in an environment as harsh as Low Earth Orbit requires a significant effort to protect the safety of the 
crew and the integrity of the vehicles. Each Visiting Vehicle is able to meet all the ISS safety and mission 
requirements through their unique vehicle design. Sufficient margins are built into their design to account for worst- 
case on-orbit conditions. Based on a survey of best practices used across all vehicles, a 100 psid (~0.7 MPa) 
propellant tank pressure on-orbit margin is considered appropriate for safe operation. 

ISS Visiting vehicles have provided the bulk of the total ISS propellant consumption since the FGB was 
launched in 1998. With the exception of the propellant carried by the FGB and SM at launch, all of the nearly 
80,000 kg of propellants came up with visiting vehicles. Using the requirements laid out in the SRD, IRD, and the 
flight rules, the ISS Program has successfully docked or berthed visiting vehicles over one hundred and twenty times 
throughout the fourteen years of its life, so far. 

A united effort on the part of all international and commercial partners in the design and operation of visiting 
vehicles is vital to the continued life of the ISS. Success of the ISS has been possible largely with the propulsive 
support of visiting vehicle thrusters and the thousands of kilograms of propellant, life-sustaining supplies and 
hardware, and crew members carried into orbit each year by visiting vehicles. Assuming the ISS continues to 
operate until 2028, the next sixteen years require continued flights to support its operation. 

The system is not without flaws, and problems have indeed arisen with vehicle traffic. However, the Program 
has successfully proven itself to be able to operate with a high degree of success, and the process of visiting vehicle 
propulsion system design and integration promises to enable the Program to continue that success into the future. 

Appendix: Acronyms 


ATV 

BTI 

DC-1 

DFMR 

ESA 

EVA 

FDIR 

FGB 


Automated Transfer Vehicle 

Burn-Time Integration 

Docking Compartment 1 

Design for Minimum Risk 

European Space Agency 

Extra- Vehicular Activity 

Fault Detection Isolation and Recovery 

Functional Cargo Block (Russian Acronym) 
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FORP 

= 

Fuel Oxidizer Reaction Products 

HTV 

= 

H-II Transfer Vehicle 

IRD 

= 

Interface Requirements Document 

ISS 

= 

International Space Station 

JAXA 

= 

Japan Aerospace Exploration Agency 

KOS 

= 

Keep-Out Sphere 

KOZ 

= 

Keep-Out Zone 

MEOP 

= 

Maximum Expected Operating Pressure 

MDP 

= 

Maximum Design Pressure 

MLM 

= 

Multipurpose Laboratory Module 

MMH 

= 

Monomethylhydrazine 

MRM 

= 

Mini Research Module 

NASA 

= 

National Aeronautics and Space Administration 

NTO 

= 

Nitrogen Tetroxide 

OMS 

= 

Orbital Maneuvering System 

PVT 

= 

Pressure -Volume -Temperature 

RCS 

= 

Reaction Control System 

RFS 

= 

Refueling System 

RSMCS 

= 

Russian Segment Motion Control System 

SE&I 

= 

Systems Engineering and Integration 

SM 

= 

Service Module 

SRD 

= 

Safety Requirements Document 

SSRMS 

= 

Space Station Remote Manipulator System 

UDMH 

= 

Unsymmetrical dimethylhydrazine 

USTO 

= 

US Thrusters Only 

VIPeR 

= 

Vehicle Integrated Performance and Resources 
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• ISS represents the culmination of over two decades of unprecedented 
global human endeavors to conceive, design, build and operate a 
research laboratory in space. 

• Uninterrupted human presence in space has been made possible by 
an international fleet of space vehicles facilitating crew rotation, 
delivery of science experiments and replenishment of propellants 
and supplies. 

• On-orbit propulsion systems on both ISS and Visiting Vehicles are 
essential to the continuous operation of the ISS. 

• This paper compares the ISS visiting vehicle propulsion systems by 
providing an overview of key design drivers, operational considerations 
and performance characteristics. 

• Despite their differences in design, functionality, and purpose, all visiting 
vehicles must adhere to a common set of interface requirements along with 
safety and operational requirements. 

• This paper addresses a wide variety of methods for satisfying these 
requirements and mitigating credible hazards anticipated during the on-orbit 
life of propulsion systems, as well as the seamless integration necessary for 
the continued operation of the ISS. 
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ISS Visiting Vehicles 



Visiting Vehicles provide the ISS with its necessary 
lifeblood of cargo and consumables, including 
propellants. 

• 7 sets of Visiting Vehicles to date: 

• Soyuz 

• Space Shuttle Orbiters 

• Progress 

• ATV 

• HTV 

• Dragon 


• Future Vehicles 


• Cygnus (scheduled to fly Summer 201 3) 

• Commercial Crew vehicles (-2017) 



ISS Visiting Vehicles 


ISS Visiting Vehicle Flights 
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Primary (current) crew vehicle 
flying to the ISS. 

Can provide propulsive 
control to ISS in off-nominal 
cases 

Docks autonomously using its 
own propulsion system 

Flown 34 ISS Missions 

Propellant: UDMH and NTO 

Pressurant: Helium 
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Primary US crew 
vehicle until retired 

Provided propulsive 
support during mated 
missions 

Docked autonomously 
using its own 
propulsion system 

Flown 37 ISS Missions 

Propellant (OMS and 
RCS): MMH and NTO 


Pressurant: Helium 
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• Primary current cargo vehicle 

• Provides propellant refueling support 

• Provides propulsive support, including primary ISS roll 
control capability until docking of the MLM 

• Docked autonomously using its own propulsion system 

• Flown 49 ISS Missions 

• Propellant: UDMH and NTO 

• Pressurant: Helium (CPS) 

and Nitrogen(RFS) 
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Automated Transfer 


• High capacity cargo vehicle 

• Provides propellant resupply support 

• Provides propulsive support 

• Docked autonomously using its own propulsion system 

• Flown 3 ISS Missions 


• Propellant: MMH (PRSS), UDMH (RFS), and NTO 

• Pressurant: Helium 



mm 




Large capacity cargo 
vehicle 

Mates to the ISS Node 
2 port via a capture 
and berthing method 

Flown 3 ISS Missions 

Propellant: MMH and 
MON3 

Pressurant: Helium 
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Commercially-developed 
US cargo vehicle 

Mates to the ISS Node 2 
port via a capture and 
berthing method 

Only current returnable 
cargo vehicle 

Flown 3 ISS Missions 

Propellant: MMH and 
NTO 



• Pressurant: Helium 
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• Commercially- 
developed US cargo 
vehicle 

• Mates to the ISS 
Node 2 port via a 
capture and berthing 
method 

• 1 st ISS Mission 
scheduled for 
Summer 2013 

• Propellant: 

Hydrazine and NTO 




Orbital 

Innovation You Con Count On" 
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• Future commercial crew vehicles are under 
development under the Commercial Crew 
Integrated Capacity (CCiCAP) contract and 
Certification Product Contract (CPC). 
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Visiting Vehicle 
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1 .Crew Safety 

2. ISS safety 

3. Protection of ISS lifetime 

4. Protection of ISS docking and berthing 
capability 

5. Visiting Vehicle safety 

6. Mission success 



• Design and Operations driven by: 

• ISS Program requirements and constraints 

• International agreements 

• Mission goals 

• Visiting Vehicle intended purpose 

• Safety of crew and ISS structure 

• All Visiting Vehicles must meet: 

• Safety Requirements Document (SRD) 

• Interface Requirements Documents (IRDs) 

• Segment Specifications 

• All ISS Flight Rules 
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• Hazard Control - the use of design and 
operational measures to reduce the likelihood of 
hazardous effects 


• Hazard Control includes: 

• Hazard Elimination 

• Damage Control 

• Containment 

• Isolation of potential hazards 

• Failure tolerance considerations 

• Incorporation of safety devices 

• Crew operational procedures 

• Protective clothing and equipment 
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• Most common propulsion system hazards: 

• Collision 

• Contamination 

• Explosion 

• Two categories of hazards: 

• Catastrophic - hazard resulting in disabling or fatal 
crew injury, or loss of ISS or Orbiter 

• Critical - hazard resulting in non-disabling crew 
injury, severe occupational illness, loss of a major ISS 
life-sustaining element, or damage to the Orbiter or 
ground facility 
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• Methods of meeting safety requirements: 

• Fault tolerance (preferred and sometimes mandated) 

• Design for minimum risk 

• Isolation 

• Operational control 

• Fault Tolerance: 

• Catastrophic Hazards: require two fault tolerance or 
three independent inhibits 

• Critical hazard: require single fault tolerance or two 
independent inhibits 


20 



4f^\ Design Drivers for Pressure Systems 


• Water Hammer/Surge Pressure 

• Maximum Design Pressure (MDP) 

• Highest pressure driven by maximum pressures of propulsion 
system components, maximum temperature, and transient 
temperature excursions 

• Accommodates two worst case failures 

• Maximum Expected Operating Pressure (MEOP) 

• Maximum pressure at which system operates in nominal 
conditions. 

• MDP must have sufficient margin above MEOP 


Over-Pressurization Protections 
Primary Regulator Set Point 
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and Operations - Flight Rules 
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• Flight rules: 

• Developed in a joint effort by MOD, ISS engineering 
specialists, and vehicle owners 

• Integrate relevant engineering constraints 

• Outline procedures for nominal mission operations 

• Assign responsibility and authority 

• Plan a course of action for potential contingencies 
and anomalies 
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• 4 primary propellant quantity gauging methods 


• PVT method 

• Uses ideal gas law pv = nRT 


BTI method 


m = F* TJI sp 
F - (K1 P avg ) + K2 


m = consumption in kg 
F = thrust in kg f 
T on = total on-time in seconds 
l sp = specific impulse 

P avg = the average pressure of all tanks feeding the thruster in kg/cm 2 
K1 and K2 = constants derived from the acceptance test data for each 
type of thruster 


• Radio frequency method 

• Physical measuring device utilizing properties of diaphragm tanks 
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Integration and Operations 


• System priming 

• Flight in regulated vs blowdown mode 

• Thruster failure detection and reaction 

• Docking vs Capture and Berthing 

• Thruster inhibits during docked or berthed phase 

• Propulsive support - attitude control and translation 

• Russian Control 

• USTO 

• Loads and structural concerns 

• Propellant resupply 

• ISS atmosphere contamination 

• Abort capability 
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• Commanded by Service Module computers 

• 2 modes: 

• Russian Segment Motion Control System (RS MCS) 

• US - Thrusters Only (USTO) 

• Roll Attitude Control 

• Service Module 

• Progress at DC-1 Nadir or MRM2 Zenith 

• MLM (scheduled for launch in Dec 2013) 

• Pitch/Yaw Attitude Control 

• Service Module 

• Progress at SM-Aft 

• ATV at SM-Aft 
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• Significant portion of ISS thruster control is 
dedicated to translational control (mostly 
re boosts) 

• Translational control 

• Progress R&D thrusters at SM-Aft 

• ATV thrusters (OCS or ACS) at SM-Aft 

• SM Main Engines 

• Progress Mid-Ring thrusters at DC-1 Nadir 

(AV < 0.7 m/s only) 
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• ISS Total On-Orbit Propellant Capacity = 7460 kg 

• Maximum Propellant Capacity of FGB = 6600 kg 

• Maximum Propellant Capacity of SM = 860 kg 

• Total Propellant consumed over ISS Program: 

nearly 80,000 kg 

• Propellant provided by Visiting Vehicles: 

-75,000 kg 
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ISS Propellant Load vs. Yearly Prop Consumption 
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• General crew or atmosphere contamination 
risks are relatively minor except during 

• EVA contamination risks: 

• Fuel and Oxidizer Reaction Product (FORP) 

• Gross propellant leakage 

• Contamination deposited on a spacesuit 

• Protections in place: 

• Procedures to wipe down suits during EVA 

• Procedures to clean suits after EVA 

• Procedure to eliminate contamination in airlock 

• Keep Out Zones (KOZ) in vicinity of thrusters 

• Vehicles must show maximum undetectable propellant leakage 
is < 150 grams/hour 

• Thruster inhibits request for crew to enter KOZ 

• Some workarounds available if minimum # of inhibits is not 
possible 


EVAs 




Abort capability necessary to protect against 
propulsion system failure or malfunction: 

• Unsafe trajectory 

• Loss of pressurization during regulated mode 

• Thrusters failures 

• Delay in departure burn 


• Etc 


Approach Ellipsoid 


Keep-out Sphere 



Approach Ellipsoid (AE) and Keep Out Sphere (KOS) 
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• Visiting Vehicles are necessary for continued operation of the ISS. 

• Each Visiting Vehicle is able to meet all the ISS safety and mission 
requirements through their unique vehicle design. 

• Sufficient margins are built into their design to account for worst- 
case on-orbit conditions. 

• VVs have provided the bulk of the total ISS propellant consumed since 
the FGB was launched in 1998 with a total of -70,000 kg 

• Using the requirements laid out in the SRD, IRD, and the flight rules, 
the ISS Program has successfully docked or berthed visiting vehicles 
over one hundred and twenty times throughout the fourteen years of its 
life. 

• United effort on part of all international and commercial partners in 
design and operation of visiting vehicles is vital to the continued 
operation of the ISS. 
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